Description

The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted TLS messages, related to statem/statem.c and statem/statem_lib.c.

Remediation

References

CVE-2016-6307

Related Vulnerabilities

Atlassian Confluence Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-29450)

WordPress Plugin Media Library Assistant Multiple Cross-Site Scripting Vulnerabilities (2.73)

WordPress Plugin Export Users With Meta SQL Injection (0.6.4)

WordPress Plugin Zendesk Chat Cross-Site Scripting (1.2.5)

Oracle Database Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2007-2113)

Severity

Medium

Classification

CVE-2016-6307 CWE-400 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities